Five Eyes and VPNs: Privacy Implications

The phrase "Five Eyes" turns up in a lot of VPN advertising and in a lot of forum arguments. Some people insist you should never touch a service based in one of those countries. Others say the whole subject is nonsense. Both camps usually skip the part that matters: what, precisely, could a Five Eyes interest do to a person who connects through a VPN, and does the answer depend on where the company has its office?

This article takes the practical route. We follow a single connection from your phone to a website, mark the points where an observer could learn something, and then ask who really has a reason to worry. If you want a broader introduction to the word "jurisdiction" and how it applies to companies, our piece on VPN jurisdiction covers it. Here we focus on privacy implications for you as a user.

The alliance in a few sentences

The Five Eyes is an intelligence-sharing arrangement among the United States, the United Kingdom, Canada, Australia and New Zealand. Its roots go back to a signals-intelligence agreement made shortly after the Second World War, and parts of that agreement became public decades later. In 2013, documents leaked by a former US contractor described large collection programmes and close cooperation between the agencies in several of these countries, which is why the name became familiar to everyday internet users.

Two points frame everything that follows.

• It is an arrangement between government agencies, not a single organisation with one rulebook. Each country has its own laws, courts and oversight.
• Most of the detail is secret. Public documents show that cooperation exists, not how much, how often or about whom. Anyone who claims to know exactly what is shared is guessing.

With that said, let us look at a real connection.

Follow one connection from your phone to a website

Imagine Malee sits in a Bangkok cafe and opens her email on her phone with the VPN on. Her request does not simply go from phone to email server. It crosses several places where something can be observed.

Vantage point	What it can see with a VPN on	What it cannot see
The cafe network	That your device connects to a VPN server, the volume and timing of traffic	Which sites you visit, the content
Your internet provider	The same as the cafe: a connection to the VPN server	Sites and content inside the tunnel
The VPN company	Your account, the time you connect, the source address, possibly the destinations, depending on its design and policy	Content of HTTPS pages
Networks between the VPN server and the website	Traffic leaving the VPN server toward a destination	Which customer it belongs to, unless data is matched up
The website itself	The VPN server's address and whatever you log in with	Your real network address, unless something leaks
Your own device	Everything	Nothing is hidden from software already installed on it

A Five Eyes agency is not a separate row in this table. It is an observer that might have legal access to one or more of these rows, depending on where the cable, company or device sits and which laws apply. So the useful question is: which row could this observer reach, and what would it learn there?

What encryption stops and what it leaves exposed

Modern encryption does a specific job. It scrambles the content of your traffic so that people who capture it in transit cannot read it. Web pages protected by HTTPS add their own layer, as described in what a VPN encrypts. Whether an observer is a cafe owner or a national agency, properly implemented encryption does not change in strength according to who is looking. The mathematics do not care about flags.

What encryption leaves exposed is the surrounding information, usually called metadata.

• That a connection exists, and between which two network addresses.
• When it starts and ends, and how long it lasts.
• How much data flows, in each direction, and in what rhythm.
• Patterns over time, such as a device that connects every morning at the same hour.

Researchers have long known that a watcher who can see both ends of a path, for instance traffic entering a VPN server and traffic leaving it, may be able to match the two by timing and size. This is called traffic correlation. It is difficult, needs access to both places, and is not something an ordinary criminal or advertiser can do. It is, however, the type of capability that a well-resourced state actor might theoretically have. For most people this is a distant risk. It matters mainly to those with a specific, serious reason to believe they are a target.

Finally, encryption does nothing when the endpoint is compromised. If malware sits on your phone, or if you log in to an account that records your activity, the tunnel is irrelevant. What a VPN cannot protect you from lists these gaps in more detail.

Alliance sharing versus a provider's own records

People often blur two different things: cooperation among agencies, and the data a VPN company holds. They are separate, and treating them separately makes the debate clearer.

1. What the provider holds. If a company stores very little, there is little to hand over, whichever country asks. If it stores a lot, then any lawful request that reaches it, from any country, can obtain a lot. The provider's data practices are the most important variable you can check.
2. Which legal orders can reach the provider. This depends on where the company is incorporated, where it has staff and where it keeps equipment. A company in a Five Eyes country is subject to that country's courts. A company elsewhere is subject to its own country's courts, and may still be reached through treaties.
3. What agencies do on their own. Agencies can collect traffic from cables and exchange points without asking the provider. That activity does not depend on the VPN company's location at all. It depends on where the traffic travels.

Notice what follows from point three. Choosing a company in a country outside the alliance does nothing about interception of traffic in transit, because the packets still cross the same global networks. It only changes which legal orders can compel the company. That is a real but narrow effect, and it is only meaningful if the company also holds little data. This is why we say the company's records matter more than its address.

Who has a real reason to care

The honest answer is that most people do not need to organise their VPN choice around the Five Eyes. A few do. The table gives four profiles to help you place yourself.

Profile	Main realistic risks	Does Five Eyes location change the choice?
Tourist using hotel and airport Wi-Fi	Rogue hotspots, phishing, stolen passwords	Rarely. Focus on a reliable app and clear terms
Remote worker handling client files	Shared networks, account takeover, employer policy	Seldom. Follow your employer's rules, use strong sign-ins
Student in shared accommodation	Other residents on the network, account sharing	No. Basic protections matter far more
Person with a specific, serious reason to expect state-level attention	Targeted surveillance, device compromise	Possibly, but a VPN alone is far from enough

The last group is small. For them, a VPN is one small tool in a larger plan that involves careful device hygiene, compartmentalised accounts and professional advice. A privacy article, including this one, is not a substitute. If you recognise yourself in that group, start with the threat model guide and the resources at the Electronic Frontier Foundation's Surveillance Self-Defense site.

For everyone else, the Five Eyes question is interesting but secondary to simple habits.

Questions to ask a provider that mention Five Eyes

If the topic worries you, use it as a prompt for useful questions rather than a yes-or-no filter.

1. Where is the company incorporated, and where does it have staff? Look for a clear answer on the website.
2. What does the company store about an account and a session? Compare the privacy policy with any published reports of legal requests.
3. What happens when an official request arrives? Look for a described process, not a slogan.
4. Does the company say it will tell users when allowed? This tells you about its attitude to disclosure.
5. Who handles payments, and what do they pass on? A third-party processor may hold more than the VPN company does.
6. Does the app ask for permissions it does not need? Over-collecting apps are a bigger practical risk than a head office.

Read the answers as a set. A company with excellent practices in a Five Eyes country may serve you better than a vague one in a country outside it. The reverse can also be true. Location is one input.

Five Eyes marketing claims, decoded

Because the name is memorable, marketing uses it. Here are common lines and how to read them.

• "We are based outside the Five Eyes." True or false is checkable. Whether it matters depends on data practices and on the other legal orders that apply instead.
• "Our servers are not in Five Eyes countries." Server location is not the same as company location, and traffic still crosses networks everywhere. Treat it as a minor detail.
• "Five Eyes countries spy on you, we protect you." This overstates what any VPN does. Encryption protects content in transit; it does not make you invisible.
• "We have no jurisdiction problems." There is no place without legal rules. A claim of freedom from all law is a warning sign, not a feature.

A trustworthy provider tells you clearly where it is based and what it stores, admits limits, and does not turn a geopolitical term into a sales hook.

Reducing your exposure without depending on any country

Because so much of the risk is independent of a company's address, the most effective steps are ones you control directly.

1. Prefer HTTPS everywhere. It encrypts content between you and the website, with or without a VPN.
2. Give services as little as possible. Use an email address that does not contain your name for accounts that do not need it, and avoid filling optional profile fields.
3. Separate identities. Do not use the same login for work, shopping and social media. A leak in one place should not unlock all.
4. Turn on two-factor authentication for email and banking so that a stolen password is not enough.
5. Keep devices updated. Most real-world compromises exploit old software, not clever spying.
6. Keep the VPN switched on for shared networks. That is where a VPN does its most reliable work.
7. Learn what your apps send. Many apps share data with advertising companies regardless of your VPN.
8. Read the provider's terms on retention and requests, and recheck after major changes.

None of these steps needs knowledge of any treaty, and each one reduces risk from observers of every kind. For the wider question of how tracking works even when a VPN is on, see can you be tracked with a VPN.

Limits and honest uncertainty

• Secrecy limits knowledge. Neither this article nor any marketing page can tell you what agencies do in practice. Public documents are partial and sometimes years old.
• Laws change. Rules on data retention, assistance orders and oversight shift over time. Check current official sources if a legal question affects you, and ask a qualified professional for legal advice.
• A VPN is not a legal shield. It does not change what is lawful. Activity that is illegal remains illegal when done through a tunnel.
• No tool makes you anonymous. Accounts, cookies, devices and behaviour identify people, and a VPN removes only one clue.
• Do not outsource the whole decision to one fact. Company address, server location, payment method and app quality all matter together.

Summary

The Five Eyes is a long-standing intelligence-sharing arrangement among five countries, but its practical effect on a VPN user depends on what the provider stores, which legal orders reach it and what happens to traffic outside the tunnel. Encryption protects content in transit regardless of who is watching, while metadata, timing patterns and compromised devices remain open issues. Most travellers, remote workers and students gain more from HTTPS, strong sign-ins and updates than from avoiding a country on a list. Treat location as one factor, ask providers specific questions and be wary of marketing that turns geopolitics into a selling point.

If a simple prepaid option fits your plans, you can look at the pricing page whenever you are ready.